{"action":"created","issue":{"url":"https://api.github.com/repos/graphcool/graphcool/issues/530","repository_url":"https://api.github.com/repos/graphcool/graphcool","labels_url":"https://api.github.com/repos/graphcool/graphcool/issues/530/labels{/name}","comments_url":"https://api.github.com/repos/graphcool/graphcool/issues/530/comments","events_url":"https://api.github.com/repos/graphcool/graphcool/issues/530/events","html_url":"https://github.com/graphcool/graphcool/issues/530","id":256781386,"number":530,"title":"Hide existence of records the API user has no permissions to access","user":{"login":"jonathanheron","id":394524,"avatar_url":"https://avatars1.githubusercontent.com/u/394524?v=4","gravatar_id":"","url":"https://api.github.com/users/jonathanheron","html_url":"https://github.com/jonathanheron","followers_url":"https://api.github.com/users/jonathanheron/followers","following_url":"https://api.github.com/users/jonathanheron/following{/other_user}","gists_url":"https://api.github.com/users/jonathanheron/gists{/gist_id}","starred_url":"https://api.github.com/users/jonathanheron/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jonathanheron/subscriptions","organizations_url":"https://api.github.com/users/jonathanheron/orgs","repos_url":"https://api.github.com/users/jonathanheron/repos","events_url":"https://api.github.com/users/jonathanheron/events{/privacy}","received_events_url":"https://api.github.com/users/jonathanheron/received_events","type":"User","site_admin":false},"labels":[{"id":502078571,"url":"https://api.github.com/repos/graphcool/graphcool/labels/area/permissions","name":"area/permissions","color":"fbca04","default":false},{"id":490864289,"url":"https://api.github.com/repos/graphcool/graphcool/labels/component/engine","name":"component/engine","color":"d4c5f9","default":false},{"id":585695283,"url":"https://api.github.com/repos/graphcool/graphcool/labels/stage/discussing","name":"stage/discussing","color":"006b75","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2017-09-11T17:25:09Z","updated_at":"2017-09-11T19:45:05Z","closed_at":null,"author_association":"NONE","body":"_(I'm new to GraphQL, so please excuse me if what I propose below runs counter to how GraphQL should behave)_\r\n\r\n## Scenario\r\n\r\nUsing the Relay API, it is possible to get the `count` of any type, even if permissions do not give you access to the items you are querying.\r\n\r\nFor example, in the screenshot below I'm getting the total count of users for an app which has all API access restricted to authenticated users. (Note: the individual user records are correctly hidden.)\r\n\r\n<img width=\"931\" alt=\"screen shot 2017-09-11 at 18 01 00\" src=\"https://user-images.githubusercontent.com/394524/30286947-4a9d62ec-971b-11e7-9984-417da231a168.png\">\r\n\r\nWhen used in combination with filters, it is possible to check for the existence of very particular records in the DB. For example, you can check if a user has any account with an app using `allUsers(filter: {email: \"jane.doe@example.com\"}) {`\r\n\r\n<img width=\"935\" alt=\"screen shot 2017-09-11 at 18 04 26\" src=\"https://user-images.githubusercontent.com/394524/30287140-ddc121e4-971b-11e7-92b5-26efef31de65.png\">\r\n\r\n## Impact\r\n\r\n* The existence of user accounts is revealed, which can have privacy and ([somewhat dubious](https://kev.inburke.com/kevin/invalid-username-or-password-useless/)) security implications.\r\n* Depending on the data model of a given app, sensitive business data could be revealed such as number of paying customers.\r\n\r\n---\r\n\r\n## Proposal\r\n\r\nI have read two related proposals ([Extend permissions types](https://github.com/graphcool/graphcool/issues/290) ; [Meta should be its own permission](https://github.com/graphcool/graphcool/issues/225)) that help mitigate this problem by adding permissions to more data. However, I don't believe they address the problem that an authenticated user can get the counts of data which matches queries they define, despite not having access to that data.\r\n\r\nA better behaviour, in my opinion, would be:\r\n\r\n1. Do not return `null` edges for nodes which cannot be accessed due to permissions.\r\n2. `Counts` should only include notes which can be accessed."},"comment":{"url":"https://api.github.com/repos/graphcool/graphcool/issues/comments/328637992","html_url":"https://github.com/graphcool/graphcool/issues/530#issuecomment-328637992","issue_url":"https://api.github.com/repos/graphcool/graphcool/issues/530","id":328637992,"user":{"login":"kbrandwijk","id":852069,"avatar_url":"https://avatars1.githubusercontent.com/u/852069?v=4","gravatar_id":"","url":"https://api.github.com/users/kbrandwijk","html_url":"https://github.com/kbrandwijk","followers_url":"https://api.github.com/users/kbrandwijk/followers","following_url":"https://api.github.com/users/kbrandwijk/following{/other_user}","gists_url":"https://api.github.com/users/kbrandwijk/gists{/gist_id}","starred_url":"https://api.github.com/users/kbrandwijk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kbrandwijk/subscriptions","organizations_url":"https://api.github.com/users/kbrandwijk/orgs","repos_url":"https://api.github.com/users/kbrandwijk/repos","events_url":"https://api.github.com/users/kbrandwijk/events{/privacy}","received_events_url":"https://api.github.com/users/kbrandwijk/received_events","type":"User","site_admin":false},"created_at":"2017-09-11T19:45:05Z","updated_at":"2017-09-11T19:45:05Z","author_association":"COLLABORATOR","body":"Still, there have been a number of different FR's, all coming down to roughly the same question: I don't want to get any results that the user is not permitted to see.\r\n\r\nEspecially with the introduction of permission functions, applying the same filter to a query as the filter in the PQ is next to impossible, and the current implementation (for both API's) will leave you with a problem.\r\n\r\nIf I define on the server side which nodes a user is permitted to see, I would simply want no information about other nodes returned. No null values, no counts, nothing.\r\n\r\nEvery database engine implements all query parts over the entire set, and then applies grouping, top(x), etc.\r\n\r\nI don't want to remove `allX` query fields, I just want them to adhere to the permissions I have set. "}}
{"actor":{"display_login":"kbrandwijk"}}